This Privacy Notice explains how and why Genesis Research Trust (GRT) uses personal information from supporters, donors, event participants, users of our website and other members of the public.

This Privacy Notice also explains how The Symposium Office uses people’s personal information as Symposium Office is part of GRT.

When we refer to “we”, “us” or “our” in this Privacy Notice we are referring to GRT.

GRT is a charity registered with the Charity Commission with Charity Number 292518. Our registered address is Imperial College London, Du Cane Road, London, W12 0NN.

In this Privacy Notice we use the term personal information to mean any information you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.

Information we collect and use

Events and Open Challenges

When you contact us to express interest in attending one of our events or open challenges, we will collect some personal information from you (for example, your name, address, email contact details, telephone number). We may collect this information:

• if you send us an email;
• if you fill in a form on our website; or
• if you give us your information over the phone, in person, or by post.

Depending on the nature of the event or open challenge, we may also need to collect additional information about you and/or any other individuals you tell us about (for example, emergency contact details, credit or debit card information, or passport details if you are participating in a challenge event abroad).

We often take photographs at events and open challenges. We may use these photographs for promotional purposes on our website, our social media pages (Twitter, YouTube, Facebook, Pinterest and Instagram and others we may be using) and in marketing materials for future events. We will always tell you in advance if we will be taking photographs at an event or open challenge and you will have the opportunity to object to your image being used in this way.

We will only collect and use your personal information for events or open challenges if:

• it is necessary to enter into, or perform, a contract with you; or
• if we are satisfied that we have a legitimate interest to record and retain this information for the purposes of putting on the event or open challenge, or to promote the work that we do.

For some events or open challenges, we may need to collect and use special categories of personal information about you, for example, information about any health condition you have to ensure that you are able to participate in a particular challenge and/or to enable us to cater to your needs during a challenge event. We will only collect and use your special category personal information in this way if we have your explicit consent.

The Symposium Office

We will collect personal information from you when you participate in an event organised by the Symposium Office or when you express an interest in attending an event organised by the Symposium Office (for example, your name, address, email contact details, telephone number). We may collect this information:

• when you send an email to the Symposium Office;
• when you fill in a form on the Symposium Office website; or
• if you give us your information over the phone, in person, or by post.

We will only collect and use your personal information in this way if:

• it is necessary to enter into, or perform, a contract with you; or
• if we are satisfied that we have a legitimate interest to record and retain this information for the purposes of putting on the Symposium Office event.

Fundraising

If you make a donation to us, we will keep a record of your personal information (for example, your name, address, email contact details, telephone number, tax status for Gift Aid purposes). We may collect this information:

• if you send us an email;
• if you fill in a form on our website; or
• if you give us your information over the phone, in person or by post.

We collect and use this information to:

• comply with our legal obligations to keep financial and business records; or
• if we are satisfied that we have a legitimate interest to record and retain this information (for example, for internal administration purposes or for contacting you to acknowledge and thank you for your donation).

If you raise funds for us via a third-party website such as Just Giving or Virgin Money Giving we may receive your personal information from them, for example, if you have given your consent for us to contact you to say thank you.

Volunteering

If you agree to volunteer for one of our campaigns or at one of our events, we will ask you to provide some personal information (including your name, telephone number and email address).

Depending on the nature of the event and your involvement, we may need to collect and use special categories of personal information about you (for example, information about any health conditions you may have for insurance purposes).

We will rely on our legitimate interests to use your personal information in order to communicate with you in advance of the event and to host the event. We may also use your personal information where we have a legal obligation to do so, for example, to comply with health and safety law.

If we collect and use any special categories of personal information about you for volunteering purposes, we will always ask for your consent.

Marketing

We would like to keep in touch with you about the work that we do, events that we organise and ways in which you can support us (for example, by volunteering your time, by giving a financial donation or donation-in-kind).

Email, SMS and Internet Messages

We will only send marketing communications to you by email, SMS and/or internet messaging (such as What’s App or Facebook Messenger) if we have your consent.

You can opt-out of electronic marketing by clicking the ‘unsubscribe’ link in any of our emails or by sending an ‘opt-out’ reply to messages. You can also email us at contact@genesisresearchtrust.com at any time to opt-out, change your contact details or to update your communication preferences.

We use a third party, Mailchimp, to deliver our email communications. If you consent to receive marketing emails from us, we will add your name and email contact details to our marketing database and we will share this information with Mailchimp in order to send the emails to you.

Mailchimp is a data processor for us and only processes your personal information in line with our instructions. If you want more information, you can view Mailchimp’s privacy notice here https://mailchimp.com/legal/privacy.

Post

We may also send marketing communications to you by post if we are satisfied that we have a legitimate interest to do so, (for example, to send a newsletter to our regular supporters), and as long as you have not previously told us that you do not want to be contacted in this way.

You can contact us at any time to tell us that you no longer wish to receive marketing by post or to update your contact details by sending an email to: contact@genesisresearchtrust.com or by post to: Genesis Research Trust, IRDB, Imperial College London, Hammersmith Hospital, Du Cane Road, London, W12 0NN.

Telephone

From time to time, we may make marketing telephone calls to you. We do not regularly carry out telephone marketing and we never use automated calling systems.

We will only contact you in this way if we are satisfied that we have a legitimate interest to do so. We will always check the Telephone Preference Service (TPS) or Corporate TPS, and our own records of your marketing preferences before we make any telephone marketing calls to you.

You can contact us at: contact@genesisresearchtrust.com or by phone on: 020 7594 9741 at any time to tell us that you no longer wish to be contacted by telephone for marketing purposes.

Visitors to our websites

We collect personal information that you provide when you fill in a form on our website. We will only collect and use your personal information in this way if:

• it is necessary to enter into, or perform, a contract with you; or
• if we are satisfied that we have a legitimate interest to record and retain this information, for example to contact you about an event or opportunity that you have expressed an interest in.

We may also collect information about how you use our website and our Cookies Policy has information about how we use cookies on our website https://www.genesisresearchtrust.com/cookie-declaration.

Our websites and materials may include links to other sites and other organisations not owned or managed by us and we cannot be held responsible for the privacy of any information that you provide to such entities.

GRT Website

Your use of the GRT website is subject to the website terms of use https://www.genesisresearchtrust.com/terms-conditions.

The network service provider for the GRT website is Imperial College London. We use a third party, Bright Matter Ltd, to host our website and they may access personal information stored on the website in the course of delivering the hosting service. Our website developers, Bright Matter Ltd, may also access personal information stored on the website as part of their work for us. These companies are data processors for us and they only process personal information in line with our instructions.

Symposium Office website

Your use of the Symposium Office website is subject to the website terms of use https://www.symposia.org.uk/docs/terms_and_conditions.pdf.

The network service provider for the Symposium Office website is Imperial College London. The Symposium Office website is hosted by a third party, Elderberry Ltd, and they may access personal information stored on the website in the course of delivering the hosting service, Elderberry Ltd, Symposium Office’s website developers, may also access personal information stored on the website as part of their work for us. These companies are data processors and only process personal information in line with our instructions.

Ask Robert

If you use the Ask Robert online form on our website to ask Professor Robert Winston a question, you will be asked to provide your name, email, phone number, postal address and details of your specific query (which may include health information).

The information you enter in the Ask Robert form is not stored on our website.  The information is sent directly to Professor Winston’s private email account, which is not hosted on our IT systems. Only Professor Winston has access to this email account and he will use this to respond to you directly by email.

We rely on our legitimate interests to collect the personal information that you provide in the Ask Robert online form and to share this information with Professor Winston for the purposes of considering, and responding to, your question. We will use any special categories of personal information you provide in the form for health and social care purposes.

A copy of the information you enter into the Ask Robert form is also sent to our askrobert@genesisresearchtrust.com email address, which is hosted by Google. Only one member of our staff can access this email account for administrative purposes and to verify your consent to publish your case study, if applicable.

We may contact you to ask for your consent to publish your question and Professor Winston’s response on our website. We will take all reasonable steps to remove information that could identify you before publication. However, due to the complex nature of some of the questions we receive, it may not be possible to completely anonymise your case study. You can withdraw your consent to publication at any time by emailing us at contact@genesisresearchtrust.com.

Case Studies

We may ask for your consent to allow us to share your experiences in materials promoting our campaigning and fundraising work (for example, your personal experience of losing a baby or your difficulties conceiving). We will only use your information in this way if we have your prior explicit consent and we will always endeavour to provide as much detail as possible about how and when your case study will be shared.

Surveys

From time to time, we ask you to take part in a survey. We will always explain how we will use any personal information that you give us by taking part in a survey.

We may use survey information to further our own legitimate interests or those of a third party (for example, to help us to improve the work that we are already doing or to assist us in developing our work in new areas).

In some circumstances, we may ask for your explicit consent to collect and use the personal information you give us in a survey (for example, if we wish to share your information with a third party or if we ask you to give us special categories of personal information).

People who contact us via social media

If you send us a private or direct message via social media (for example, Facebook, Twitter, YouTube or Instagram), we may share this information with other GRT personnel if we are satisfied that we have a legitimate interest to do so, for example, in order to respond to a specific query or to pass on information. We will not share any personal information that you provide in a message with any other organisations without your consent.

This Privacy Notice does not cover how social media websites use your personal information and you should refer to their privacy notices. We encourage you to make use of the privacy settings and reporting mechanisms available to control how your personal information is used.

If you post or send any content on our social media accounts, forums or pages that we believe to be inappropriate, offensive, or in breach of any laws (for example, defamatory content), we may use your personal information to file a report to the social media provider and/or any relevant third parties such as your internet provider or law enforcement agencies.

Queries and complaints

If you send a query or complaint to us, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint and respond to you. Where we consider it necessary or appropriate, we will share this information with third parties such as the Charity Commission, the Information Commissioner’s Office or the Fundraising Regulator.

Changes to your personal information

If your personal details change, please help us to keep your information up to date by notifying us at contact@genesisresearchtrust.com.

Sharing personal information

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will disclose your personal information to third parties:

• where you have given us consent to share the information with the specific third party;
• where information such as your email address is passed to Imperial College London for the purposes of providing IT support to us;
• when GRT’s website host Bright Matter Ltd and/or website developer Bright Matter Ltd access personal information stored on the GRT website in the course of providing their services;
• when Symposium Office’s website host Elderberry Ltd and/or website developer Elderberry Ltd access personal information stored on the Symposium Office website in the course of providing their services;
• when we share personal information with MailChimp to send out email marketing communications;
• if you make a payment online using a credit or debit card. Your details are transferred to our third party payment agent Global Payments, SagePay or PayPal who act as data processors on our behalf and under our instruction;
• when we add personal information to our customer relationship management (CRM) systems, which are hosted in the cloud. GRT uses the Donorfy CRM system and the Symposium Office uses Salesforce;
• to process Gift Aid applications;
• to effect delivery to you of any service or product you have requested;
• to a tour operator to enable you to take part in a challenge you are taking part in or have applied for;
• to an event organiser in respect to any event you are taking part in or have applied to take part in;
• if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
• where we are required to share information with regulators such as the Information Commissioner’s Office, the Charity Commission or the Fundraising Regulator;
• to share information with our auditors, lawyers or other professional advisers;
• in order to enforce any terms and conditions or agreements between us;
• as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation (we will always notify you in advance and we will aim to ensure that your privacy rights will continue to be protected); or
• to protect our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction).

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. For example, we may share anonymised results of research that we carry out into the use of our services with third parties such as funders.

Data Security

We have appropriate security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

All personal information collected by us is stored securely. Our IT systems are hosted by Imperial College London, however, access to our systems is restricted to GRT personnel.

We use SSL technology (secure server software) to protect your information. If you have been allocated a user account, this area is protected by your user name and password, which you should never divulge to anyone else. You are responsible for keeping this password confidential and we ask you not to share your password with anyone.

• We store papers in lockable cabinets in our offices when not being actively used.
• Our offices are secure and only personnel holding appropriate security passes can access areas where personal information is stored.
• We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
• We limit access to your personal information to those employees, volunteers, agents, contractors and other third parties who have a need to know to fulfil their obligations and duties.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. However, the transmission of information via the internet is never completely secure.

Although we will do our best to protect your personal information, we cannot guarantee the security of your electronic information transmitted to us and any transmission is at your own risk. We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our reasonable control.

Transferring your personal information outside the EEA

We may transfer the personal information you give us to countries outside the European Economic Area (EEA), for example:

• when one of our third-party providers is located overseas (for example, Salesforce);
• when you are partaking in one of our overseas challenges (for example, when we book your accommodation); or
• if we are required to do so by law.

If we transfer your information outside of the EEA, and the country in question has not been deemed by the EU Commission to have adequate data protection laws, we will provide appropriate safeguards and we will be responsible for ensuring your privacy rights continue to be protected as outlined in this notice. If you would like more information about the safeguards we put in place, please contact: contact@genesisresearchtrust.com.

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Our default retention period for personal information is 7 years from the date we receive the information, unless otherwise specified by law. However, we may keep certain records for shorter or longer periods as we deem necessary, for example:

• to provide a service to you such as taking part in one of our events;
• where you have given us permission to use your personal information to contact you in the future (for example, for marketing, fundraising or campaigning purposes); or
• where we have a legal or regulatory requirement to keep records for longer than 7 years; or
• for archiving purposes (for example, photographs of past events or challenges); or
• to defend legal proceedings or if there is an on-going investigation relating to the information.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

We review the personal information (and the categories of personal information) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain information we are holding is no longer necessary or accurate, we will take steps to correct or delete the information.

Where your information is no longer required, we will ensure it is disposed of in a secure manner.

Your rights

Under certain circumstances, by law you have the right to:

• Receive the information contained in this Privacy Notice
• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.

If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact our Office Manager by email: contact@genesisresearchtrust.com or by telephone: 020 7594 9741. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.

You also have rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces significant legal effects concerning you.

If you want to exercise any of these rights, please contact our Office Manager, preferably in writing, by email: contact@genesisresearchtrust.com or by post: Genesis Research Trust, IRDB, Imperial College London, Hammersmith Hospital, Du Cane Road, London, W12 0NN.

Feedback or Complaints

Our Office Manager oversees compliance with this Privacy Notice. If you have any feedback, questions or complaints about this Privacy Notice or how we handle your personal information, please contact.

• Email: contact@genesisresearchtrust.com
• Post: Genesis Research Trust, IRDB, Imperial College London, Hammersmith Hospital, Du Cane Road, London, W12 0NN
• Telephone: 020 7594 9741

Your comments are welcome and they help us to learn and improve.

If you think there is a problem with the way we are handling your personal information, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.